In detail, how does SSL offloading/acceleration/termination work?

Question

What is the in-depth working mechanism of SSL offloading/termination? I could not find literature that would dive deep enough into the subject.

Assume the following example, where a intends to download a resource on the webserver (the client is not aware that an SSL terminator is installed).

Client++++++++++(SSL terminator)······Webserver

Questions:

• Does the client establish the TCP connection to the SSL terminator or to the Webserver?
• Does the SSL Terminator affect the TCP connection in any way?

If there is material on line explaining this, please point me to it. Thank you!

Answer 1

There are two sessions:

Client <====1====> SSL Terminator <====2====> Webserver

Each of those is a TCP session.

Session 1 is SSL-over-TCP, and session 2 is plain TCP.

SSL Terminator has dedicated hardware which speeds up the SSL encryption/decryption process (commonly 'cryption is "offloaded" to specialized cards). Because this special hardware is less easily available to use on the webserver itself, the SSL Terminator fills a niche.

Some related reading:

• SSL Offloading from F5
• SSL Acceleration from Wikipedia (bear in mind, an SSL Terminator may simply be a device that takes advantage of SSL acceleration hardware without the webserver admin needing to muck with hardware or APIs).
• SSL Offloading from nginx

Answer 2

Does the client establish the TCP connection to the SSL terminator or to the Webserver?

With SSL offload enabled the client makes an SSL connection to the SSL terminator, then the unencrypted traffic is passed to the webserver from the SSL terminator. If SSL Offload is disabled the SSL traffic is passed through directly to the webserver(SSL pass-through). Also note normally the webserver is setup to run on a different port than 443 (81, 8181, 4433, etc. to an internal IP or IPs depending on your configuration).

Does the SSL Terminator affect the TCP connection in any way?

Modification of the connection depends on the configuration of the SSL terminator. Example: If you enable analytics, deep packet inspection or stripping of detected malicious data or have certain rules setup to only allow the type of traffic you want, modifications can occur before traffic is passed to the webserver or passed back to the client from the webserver or SSL terminator.

This can cause the SSL terminator to drop anything that does not meet your requirements, add special cookies for load balancing, security, inject JavaScript for analytics, or other pre-defined options you have configured. Also note, even if SSL pass-through is enabled/disabled depending on your configuration options the TCP packets may or may not be modified before being sent to the webserver.